Internal Control for Information Security

| “Security controls are the management, operational, and technical safeguards or countermeasures employed within an organizational information system to protect the confidentiality, integrity, and availability of the system and its information” (NIST SP 800, 2009). The control allows the organization to efficiently mitigate the risk coming from the use of information System (IS) to conduct business operations and processes.

In addition to audit controls, access controls are important because they help reduce the risk of internal data breaches by preventing unauthorized work staff to have access to ePHI. “Only individuals with a “need to know” should have access to ePHI” (Brodnik, Finehart-Thompson, & Reynolds, 2012, p. 304). Additionally, Brodnik et al., (2012), states that access controls are used to aid in the authentication, audit and authorization process by implementing unique specifications such as: a unique user identification number, emergency access procedures, having an automatic log offs, and by having unique specifications within the system that allows for encryption and decryption

The purpose of this document is to provide guidelines for selecting and identifying security controls for information systems supporting the Department of Defense (DoD). These guidelines have been established to help complete a secure system within the agency. Guidelines provided in the NIST Special Publication 800-53 are relevant to all federal information systems and have been mostly established from a technical view to supplement related guidelines for national security systems.

Organizations emphasized the use of physical security to help enable the use of physical access controls. It was reported that physical security became difficult to manage due to technology becoming complex every day (Hutter,2016). It was indicated that organization often over looked physical security until after a serious event had occurred. Per Hutter, physical security threats were either internal or external. Employees were considered external threats when they gain access to unobserved areas and were considered internal threats when their knowledge was utilized. Organizations were noted to implement the use of physical security through locked doors, access control systems (i.e. Paxton Access Inc, Identiv), alarm systems and many other important applicable measures.

internal controls are controls or safeguards that a business puts into practice to assure that fraud and crime won’t take place within their business. examples of internal controls are having management confirm transactions, or having login code for individual employees who access important data. No internal controls plan is flawless and the bigger their are the more expensive and time consuming they are. But, internal controls are vital for the success of a business; they should be tested and improved regularly.

If one were to ask the question, “What is security?” the response of the majority of the population would likely be: alarm systems, guards in uniform, locks, and barred doors & windows. While this is always a great place to start, these are not the only measures that need to be considered when making an effort to secure an information system. Because physical security is a pivotal component of all security plans and is key to all security efforts, it makes the initiation of access control, software security, information technology security, and network security that much more difficult. Anytime unauthorized access to facilities, assets, or resources has been denied, this is a situation in which physical security has been implemented successfully. One may ask the question, “What is physical security?” Physical security is a complex concept comprised of security measures that have been designed to protect employees and property from vandalism and damage, and prevent unauthorized access to the company’s facility or resources. There are many preventative measures that aid in the utilization of physical security. There are many measures that should be considered in the assessment of a company’s security plan. These measures include, but are not limited to, securing the interior of the building, securing the exterior of the building, natural surveillance, biometrics, protection of the company’s assets from environmental factors, the employee factor, and protection of the

There were a number of factors that contributed to the breach, which had they been addressed or had corresponding mitigation responses in place, would have reduced the likelihood that the breach would have taken place, or at a minimum reduce the impact of the attack. These items range from policy related issues, technology implementations, and security management and maintenance. Although I believe a number of these areas were in the process of being addressed, based on the information gathered regarding the details of the incident, it appears that it was still in many areas insufficient and would not have prevented an incident even if there had been more time available to perform the implementations.

Internal controls are necessary for organizations of any nature and particularly those that are numbers driven such as accounting, and finance. They safeguard assets, maintain records, prepare and promote financial reports and operational efficiency, adhere to management and ensure compliance with regulations. “Information systems encounter serious security threats that may arise from the weakness of the internal controls and/or the nature of the competitive environment as the need and dependency on information increases” (Hayale & Abu- Khadra, 2006). With internal controls, organizations can bring out value and not just lessen their risk. And this is where becomes applicable. Cobit as a framework ensures that internal controls are effective and efficient. Cobit is the generally accepted internal control framework for IT. (ISACA, 2016).

The biggest threat to any company is not distributed denial of services (DDOS), malware attacks, phishing, or hackers. Most data breaches usually trigger by an Insiders, such as an employee, who poses a great threat to the company by exposing internal affairs to outside world. Insider can commit such activities with or without intentions and have an access to information that is not known to cybercriminals. An Insider can uncover company’s security information, inject viruses/worms/trojans, and can leave a logic bomb into the system. This Research paper will explain the key factors that will help a company to protect from inside threat and to prove how an insider can be a threat.

Use of identifying passcodes enables the company to establish responsibility by identifying the particular employee who carried out the activity and eliminate deception. This way whichever employee needs to access the petty cash desk drawer must use their confidential passcode. A note as an I.O.U is never considered an acceptable means of recording of a type of company transaction.

In addition to continuity planning organizations must maintain a current security policy that enforces employee training. Human threats either intentionally or unintentional can have a significant effect on an organization. Physical security is only half the battle organizations must also have those logical controls in place. Threats come from outside influences that want to penetrate the business the reasons range from stealing data to hacktivism. As corporations continue to face new risks they also have to contend with the difficult task of protecting both internal and external customers against identity theft.

Control is a set of mechanism that assists an organization to attain the desired objective. Control is fundamental to achieve organizational goal, and control aligns the aspiration of workforce with their capabilities. On the other hand, internal control for information security is the practice policies, procedures and responsibility structure that assists an organization to manage risks and protects organization information assets. Internal control plays a critical role in the overall effectiveness of information security. Much security breach within an organization often occurs because of lack of proper internal control structure. The United States enacts Sarbanes-Oxley Act in response to the public outcry that there was a lack of internal control assessment within most organizations in the United States. Typically, effective internal control assists an organization to achieve a business integrity, adequate security governance and business continuity. Lack of effective control could lead to a security breach or subversion and could lead to the inability to implement effective control information security system. (Sushma & Gurpreet 2005). Internal control for information security needs to be designed to minimize business risks and maximize return on investment (ROI).

Modern businesses are faced with major security threats especially to their information systems. The complexity of systems has not helped in mitigating these threats. With the massive adaption of information systems within organizations, they have become the cornerstones for organizations and this has made the systems more vulnerable to sabotage and potential attacks. There are both external and internal threats to information systems, which can be accidental or intentional. The threats to information systems are multilayered, and they can affect a couple of components like networks, software applications, operating systems, intranet, internet, and wireless technologies.

The Committee of Sponsoring Organization’s Internal Control Integrated Framework is a study that establishes a common definition of internal control so as to meet the needs of various parties and it provides a standard in which organizations can use to assess their control systems and determine if and how to improve them. Since internal control is a process and addresses the achievement of objectives, not all controls are relevant to an audit; the controls that may affect the reliability of financial reporting are relevant to an audit.

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets.  A framework is the outline from which a more detailed blueprint evolves.  The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies.  The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years.  The blueprint is used to plan the tasks to be accomplished and the order in which